ApplyArchiveRule

$result = $client->applyArchiveRule([/* ... */]);
$promise = $client->applyArchiveRuleAsync([/* ... */]);

Retroactively applies the archive rule to existing findings that meet the archive rule criteria.

Parameter Syntax

$result = $client->applyArchiveRule([
    'analyzerArn' => '<string>', // REQUIRED
    'clientToken' => '<string>',
    'ruleName' => '<string>', // REQUIRED
]);

Parameter Details

Result Syntax

[]

Result Details

Errors

ResourceNotFoundException:

The specified resource could not be found.

ValidationException:

Validation exception error.

InternalServerException:

Internal server error.

ThrottlingException:

Throttling limit exceeded error.

AccessDeniedException:

You do not have sufficient access to perform this action.

CancelPolicyGeneration

$result = $client->cancelPolicyGeneration([/* ... */]);
$promise = $client->cancelPolicyGenerationAsync([/* ... */]);

Cancels the requested policy generation.

Parameter Syntax

$result = $client->cancelPolicyGeneration([
    'jobId' => '<string>', // REQUIRED
]);

Parameter Details

Result Syntax

[]

Result Details

Errors

InternalServerException:

Internal server error.

ValidationException:

Validation exception error.

ThrottlingException:

Throttling limit exceeded error.

AccessDeniedException:

You do not have sufficient access to perform this action.

CheckAccessNotGranted

$result = $client->checkAccessNotGranted([/* ... */]);
$promise = $client->checkAccessNotGrantedAsync([/* ... */]);

Checks whether the specified access isn't allowed by a policy.

Parameter Syntax

$result = $client->checkAccessNotGranted([
    'access' => [ // REQUIRED
        [
            'actions' => ['<string>', ...],
            'resources' => ['<string>', ...],
        ],
        // ...
    ],
    'policyDocument' => '<string>', // REQUIRED
    'policyType' => 'IDENTITY_POLICY|RESOURCE_POLICY', // REQUIRED
]);

Parameter Details

Result Syntax

[
    'message' => '<string>',
    'reasons' => [
        [
            'description' => '<string>',
            'statementId' => '<string>',
            'statementIndex' => <integer>,
        ],
        // ...
    ],
    'result' => 'PASS|FAIL',
]

Result Details

Errors

InternalServerException:

Internal server error.

ValidationException:

Validation exception error.

InvalidParameterException:

The specified parameter is invalid.

UnprocessableEntityException:

The specified entity could not be processed.

ThrottlingException:

Throttling limit exceeded error.

AccessDeniedException:

You do not have sufficient access to perform this action.

Examples

Example 1: Passing check. Restrictive identity policy.

$result = $client->checkAccessNotGranted([
    'access' => [
        [
            'actions' => [
                's3:PutObject',
            ],
        ],
    ],
    'policyDocument' => '{"Version":"2012-10-17","Id":"123","Statement":[{"Sid":"AllowJohnDoe","Effect":"Allow","Principal":{"AWS":"arn:aws:iam::123456789012:user/JohnDoe"},"Action":"s3:GetObject","Resource":"*"}]}',
    'policyType' => 'RESOURCE_POLICY',
]);

Result syntax:

[
    'message' => 'The policy document does not grant access to perform the listed actions or resources.',
    'result' => 'PASS',
]

Example 2: Passing check. Restrictive S3 Bucket resource policy.

$result = $client->checkAccessNotGranted([
    'access' => [
        [
            'resources' => [
                'arn:aws:s3:::sensitive-bucket/*',
            ],
        ],
    ],
    'policyDocument' => '{"Version":"2012-10-17","Id":"123","Statement":[{"Sid":"AllowJohnDoe","Effect":"Allow","Principal":{"AWS":"arn:aws:iam::123456789012:user/JohnDoe"},"Action":"s3:PutObject","Resource":"arn:aws:s3:::non-sensitive-bucket/*"}]}',
    'policyType' => 'RESOURCE_POLICY',
]);

Result syntax:

[
    'message' => 'The policy document does not grant access to perform the listed actions or resources.',
    'result' => 'PASS',
]

Example 3: Failing check. Permissive S3 Bucket resource policy.

$result = $client->checkAccessNotGranted([
    'access' => [
        [
            'resources' => [
                'arn:aws:s3:::my-bucket/*',
            ],
        ],
    ],
    'policyDocument' => '{"Version":"2012-10-17","Id":"123","Statement":[{"Sid":"AllowJohnDoe","Effect":"Allow","Principal":{"AWS":"arn:aws:iam::123456789012:user/JohnDoe"},"Action":"s3:PutObject","Resource":"arn:aws:s3:::my-bucket/*"}]}',
    'policyType' => 'RESOURCE_POLICY',
]);

Result syntax:

[
    'message' => 'The policy document grants access to perform one or more of the listed actions or resources.',
    'reasons' => [
        [
            'description' => 'One or more of the listed actions or resources in the statement with sid: AllowJohnDoe.',
            'statementId' => 'AllowJohnDoe',
            'statementIndex' => 0,
        ],
    ],
    'result' => 'FAIL',
]

CheckNoNewAccess

$result = $client->checkNoNewAccess([/* ... */]);
$promise = $client->checkNoNewAccessAsync([/* ... */]);

Checks whether new access is allowed for an updated policy when compared to the existing policy.

You can find examples for reference policies and learn how to set up and run a custom policy check for new access in the IAM Access Analyzer custom policy checks samples repository on GitHub. The reference policies in this repository are meant to be passed to the existingPolicyDocument request parameter.

Parameter Syntax

$result = $client->checkNoNewAccess([
    'existingPolicyDocument' => '<string>', // REQUIRED
    'newPolicyDocument' => '<string>', // REQUIRED
    'policyType' => 'IDENTITY_POLICY|RESOURCE_POLICY', // REQUIRED
]);

Parameter Details

Result Syntax

[
    'message' => '<string>',
    'reasons' => [
        [
            'description' => '<string>',
            'statementId' => '<string>',
            'statementIndex' => <integer>,
        ],
        // ...
    ],
    'result' => 'PASS|FAIL',
]

Result Details

Errors

InternalServerException:

Internal server error.

ValidationException:

Validation exception error.

InvalidParameterException:

The specified parameter is invalid.

UnprocessableEntityException:

The specified entity could not be processed.

ThrottlingException:

Throttling limit exceeded error.

AccessDeniedException:

You do not have sufficient access to perform this action.

CheckNoPublicAccess

$result = $client->checkNoPublicAccess([/* ... */]);
$promise = $client->checkNoPublicAccessAsync([/* ... */]);

Checks whether a resource policy can grant public access to the specified resource type.

Parameter Syntax

$result = $client->checkNoPublicAccess([
    'policyDocument' => '<string>', // REQUIRED
    'resourceType' => 'AWS::DynamoDB::Table|AWS::DynamoDB::Stream|AWS::EFS::FileSystem|AWS::OpenSearchService::Domain|AWS::Kinesis::Stream|AWS::Kinesis::StreamConsumer|AWS::KMS::Key|AWS::Lambda::Function|AWS::S3::Bucket|AWS::S3::AccessPoint|AWS::S3Express::DirectoryBucket|AWS::S3::Glacier|AWS::S3Outposts::Bucket|AWS::S3Outposts::AccessPoint|AWS::SecretsManager::Secret|AWS::SNS::Topic|AWS::SQS::Queue|AWS::IAM::AssumeRolePolicyDocument|AWS::S3Tables::TableBucket|AWS::ApiGateway::RestApi|AWS::CodeArtifact::Domain|AWS::Backup::BackupVault|AWS::CloudTrail::Dashboard|AWS::CloudTrail::EventDataStore|AWS::S3Tables::Table|AWS::S3Express::AccessPoint', // REQUIRED
]);

Parameter Details

Result Syntax

[
    'message' => '<string>',
    'reasons' => [
        [
            'description' => '<string>',
            'statementId' => '<string>',
            'statementIndex' => <integer>,
        ],
        // ...
    ],
    'result' => 'PASS|FAIL',
]

Result Details

Errors

InternalServerException:

Internal server error.

ValidationException:

Validation exception error.

InvalidParameterException:

The specified parameter is invalid.

UnprocessableEntityException:

The specified entity could not be processed.

ThrottlingException:

Throttling limit exceeded error.

AccessDeniedException:

You do not have sufficient access to perform this action.

Examples

Example 1: Passing check. S3 Bucket policy without public access.

$result = $client->checkNoPublicAccess([
    'policyDocument' => '{"Version":"2012-10-17","Statement":[{"Sid":"Bob","Effect":"Allow","Principal":{"AWS":"arn:aws:iam::111122223333:user/JohnDoe"},"Action":["s3:GetObject"]}]}',
    'resourceType' => 'AWS::S3::Bucket',
]);

Result syntax:

[
    'message' => 'The resource policy does not grant public access for the given resource type.',
    'result' => 'PASS',
]

Example 2: Failing check. S3 Bucket policy with public access.

$result = $client->checkNoPublicAccess([
    'policyDocument' => '{"Version":"2012-10-17","Statement":[{"Sid":"Bob","Effect":"Allow","Principal":"*","Action":["s3:GetObject"]}]}',
    'resourceType' => 'AWS::S3::Bucket',
]);

Result syntax:

[
    'message' => 'The resource policy grants public access for the given resource type.',
    'reasons' => [
        [
            'description' => 'Public access granted in the following statement with sid: Bob.',
            'statementId' => 'Bob',
            'statementIndex' => 0,
        ],
    ],
    'result' => 'FAIL',
]

CreateAccessPreview

$result = $client->createAccessPreview([/* ... */]);
$promise = $client->createAccessPreviewAsync([/* ... */]);

Creates an access preview that allows you to preview IAM Access Analyzer findings for your resource before deploying resource permissions.

Parameter Syntax

$result = $client->createAccessPreview([
    'analyzerArn' => '<string>', // REQUIRED
    'clientToken' => '<string>',
    'configurations' => [ // REQUIRED
        '<ConfigurationsMapKey>' => [
            'dynamodbStream' => [
                'streamPolicy' => '<string>',
            ],
            'dynamodbTable' => [
                'tablePolicy' => '<string>',
            ],
            'ebsSnapshot' => [
                'groups' => ['<string>', ...],
                'kmsKeyId' => '<string>',
                'userIds' => ['<string>', ...],
            ],
            'ecrRepository' => [
                'repositoryPolicy' => '<string>',
            ],
            'efsFileSystem' => [
                'fileSystemPolicy' => '<string>',
            ],
            'iamRole' => [
                'trustPolicy' => '<string>',
            ],
            'kmsKey' => [
                'grants' => [
                    [
                        'constraints' => [
                            'encryptionContextEquals' => ['<string>', ...],
                            'encryptionContextSubset' => ['<string>', ...],
                        ],
                        'granteePrincipal' => '<string>', // REQUIRED
                        'issuingAccount' => '<string>', // REQUIRED
                        'operations' => ['<string>', ...], // REQUIRED
                        'retiringPrincipal' => '<string>',
                    ],
                    // ...
                ],
                'keyPolicies' => ['<string>', ...],
            ],
            'rdsDbClusterSnapshot' => [
                'attributes' => [
                    '<RdsDbClusterSnapshotAttributeName>' => [
                        'accountIds' => ['<string>', ...],
                    ],
                    // ...
                ],
                'kmsKeyId' => '<string>',
            ],
            'rdsDbSnapshot' => [
                'attributes' => [
                    '<RdsDbSnapshotAttributeName>' => [
                        'accountIds' => ['<string>', ...],
                    ],
                    // ...
                ],
                'kmsKeyId' => '<string>',
            ],
            's3Bucket' => [
                'accessPoints' => [
                    '<AccessPointArn>' => [
                        'accessPointPolicy' => '<string>',
                        'networkOrigin' => [
                            'internetConfiguration' => [
                            ],
                            'vpcConfiguration' => [
                                'vpcId' => '<string>', // REQUIRED
                            ],
                        ],
                        'publicAccessBlock' => [
                            'ignorePublicAcls' => true || false, // REQUIRED
                            'restrictPublicBuckets' => true || false, // REQUIRED
                        ],
                    ],
                    // ...
                ],
                'bucketAclGrants' => [
                    [
                        'grantee' => [ // REQUIRED
                            'id' => '<string>',
                            'uri' => '<string>',
                        ],
                        'permission' => 'READ|WRITE|READ_ACP|WRITE_ACP|FULL_CONTROL', // REQUIRED
                    ],
                    // ...
                ],
                'bucketPolicy' => '<string>',
                'bucketPublicAccessBlock' => [
                    'ignorePublicAcls' => true || false, // REQUIRED
                    'restrictPublicBuckets' => true || false, // REQUIRED
                ],
            ],
            's3ExpressDirectoryBucket' => [
                'accessPoints' => [
                    '<S3ExpressDirectoryAccessPointArn>' => [
                        'accessPointPolicy' => '<string>',
                        'networkOrigin' => [
                            'internetConfiguration' => [
                            ],
                            'vpcConfiguration' => [
                                'vpcId' => '<string>', // REQUIRED
                            ],
                        ],
                    ],
                    // ...
                ],
                'bucketPolicy' => '<string>',
            ],
            'secretsManagerSecret' => [
                'kmsKeyId' => '<string>',
                'secretPolicy' => '<string>',
            ],
            'snsTopic' => [
                'topicPolicy' => '<string>',
            ],
            'sqsQueue' => [
                'queuePolicy' => '<string>',
            ],
        ],
        // ...
    ],
]);

Parameter Details

Result Syntax

[
    'id' => '<string>',
]

Result Details

Errors

ConflictException:

A conflict exception error.

ResourceNotFoundException:

The specified resource could not be found.

InternalServerException:

Internal server error.

ValidationException:

Validation exception error.

ServiceQuotaExceededException:

Service quote met error.

ThrottlingException:

Throttling limit exceeded error.

AccessDeniedException:

You do not have sufficient access to perform this action.

CreateAnalyzer

$result = $client->createAnalyzer([/* ... */]);
$promise = $client->createAnalyzerAsync([/* ... */]);

Creates an analyzer for your account.

Parameter Syntax

$result = $client->createAnalyzer([
    'analyzerName' => '<string>', // REQUIRED
    'archiveRules' => [
        [
            'filter' => [ // REQUIRED
                '<String>' => [
                    'contains' => ['<string>', ...],
                    'eq' => ['<string>', ...],
                    'exists' => true || false,
                    'neq' => ['<string>', ...],
                ],
                // ...
            ],
            'ruleName' => '<string>', // REQUIRED
        ],
        // ...
    ],
    'clientToken' => '<string>',
    'configuration' => [
        'internalAccess' => [
            'analysisRule' => [
                'inclusions' => [
                    [
                        'accountIds' => ['<string>', ...],
                        'resourceArns' => ['<string>', ...],
                        'resourceTypes' => ['<string>', ...],
                    ],
                    // ...
                ],
            ],
        ],
        'unusedAccess' => [
            'analysisRule' => [
                'exclusions' => [
                    [
                        'accountIds' => ['<string>', ...],
                        'resourceTags' => [
                            ['<string>', ...],
                            // ...
                        ],
                    ],
                    // ...
                ],
            ],
            'unusedAccessAge' => <integer>,
        ],
    ],
    'tags' => ['<string>', ...],
    'type' => 'ACCOUNT|ORGANIZATION|ACCOUNT_UNUSED_ACCESS|ORGANIZATION_UNUSED_ACCESS|ACCOUNT_INTERNAL_ACCESS|ORGANIZATION_INTERNAL_ACCESS', // REQUIRED
]);

Parameter Details

Result Syntax

[
    'arn' => '<string>',
]

Result Details

Errors

ConflictException:

A conflict exception error.

ValidationException:

Validation exception error.

InternalServerException:

Internal server error.

ServiceQuotaExceededException:

Service quote met error.

ThrottlingException:

Throttling limit exceeded error.

AccessDeniedException:

You do not have sufficient access to perform this action.

CreateArchiveRule

$result = $client->createArchiveRule([/* ... */]);
$promise = $client->createArchiveRuleAsync([/* ... */]);

Creates an archive rule for the specified analyzer. Archive rules automatically archive new findings that meet the criteria you define when you create the rule.

To learn about filter keys that you can use to create an archive rule, see IAM Access Analyzer filter keys in the IAM User Guide.

Parameter Syntax

$result = $client->createArchiveRule([
    'analyzerName' => '<string>', // REQUIRED
    'clientToken' => '<string>',
    'filter' => [ // REQUIRED
        '<String>' => [
            'contains' => ['<string>', ...],
            'eq' => ['<string>', ...],
            'exists' => true || false,
            'neq' => ['<string>', ...],
        ],
        // ...
    ],
    'ruleName' => '<string>', // REQUIRED
]);

Parameter Details

Result Syntax

[]

Result Details

Errors

ConflictException:

A conflict exception error.

ResourceNotFoundException:

The specified resource could not be found.

ValidationException:

Validation exception error.

InternalServerException:

Internal server error.

ServiceQuotaExceededException:

Service quote met error.

ThrottlingException:

Throttling limit exceeded error.

AccessDeniedException:

You do not have sufficient access to perform this action.

DeleteAnalyzer

$result = $client->deleteAnalyzer([/* ... */]);
$promise = $client->deleteAnalyzerAsync([/* ... */]);

Deletes the specified analyzer. When you delete an analyzer, IAM Access Analyzer is disabled for the account or organization in the current or specific Region. All findings that were generated by the analyzer are deleted. You cannot undo this action.

Parameter Syntax

$result = $client->deleteAnalyzer([
    'analyzerName' => '<string>', // REQUIRED
    'clientToken' => '<string>',
]);

Parameter Details

Result Syntax

[]

Result Details

Errors

ResourceNotFoundException:

The specified resource could not be found.

ValidationException:

Validation exception error.

InternalServerException:

Internal server error.

ThrottlingException:

Throttling limit exceeded error.

AccessDeniedException:

You do not have sufficient access to perform this action.

DeleteArchiveRule

$result = $client->deleteArchiveRule([/* ... */]);
$promise = $client->deleteArchiveRuleAsync([/* ... */]);

Deletes the specified archive rule.

Parameter Syntax

$result = $client->deleteArchiveRule([
    'analyzerName' => '<string>', // REQUIRED
    'clientToken' => '<string>',
    'ruleName' => '<string>', // REQUIRED
]);

Parameter Details

Result Syntax

[]

Result Details

Errors

ResourceNotFoundException:

The specified resource could not be found.

ValidationException:

Validation exception error.

InternalServerException:

Internal server error.

ThrottlingException:

Throttling limit exceeded error.

AccessDeniedException:

You do not have sufficient access to perform this action.

GenerateFindingRecommendation

$result = $client->generateFindingRecommendation([/* ... */]);
$promise = $client->generateFindingRecommendationAsync([/* ... */]);

Creates a recommendation for an unused permissions finding.

Parameter Syntax

$result = $client->generateFindingRecommendation([
    'analyzerArn' => '<string>', // REQUIRED
    'id' => '<string>', // REQUIRED
]);

Parameter Details

Result Syntax

[]

Result Details

Errors

InternalServerException:

Internal server error.

ValidationException:

Validation exception error.

ThrottlingException:

Throttling limit exceeded error.

AccessDeniedException:

You do not have sufficient access to perform this action.

Examples

Example 1: Successfully started generating finding recommendation

$result = $client->generateFindingRecommendation([
    'analyzerArn' => 'arn:aws:access-analyzer:us-east-1:111122223333:analyzer/a',
    'id' => 'finding-id',
]);

Result syntax:

[
]

Example 2: Failed field validation for id value

$result = $client->generateFindingRecommendation([
    'analyzerArn' => 'arn:aws:access-analyzer:us-east-1:111122223333:analyzer/a',
    'id' => '!',
]);

GetAccessPreview

$result = $client->getAccessPreview([/* ... */]);
$promise = $client->getAccessPreviewAsync([/* ... */]);

Retrieves information about an access preview for the specified analyzer.

Parameter Syntax

$result = $client->getAccessPreview([
    'accessPreviewId' => '<string>', // REQUIRED
    'analyzerArn' => '<string>', // REQUIRED
]);

Parameter Details

Result Syntax

[
    'accessPreview' => [
        'analyzerArn' => '<string>',
        'configurations' => [
            '<ConfigurationsMapKey>' => [
                'dynamodbStream' => [
                    'streamPolicy' => '<string>',
                ],
                'dynamodbTable' => [
                    'tablePolicy' => '<string>',
                ],
                'ebsSnapshot' => [
                    'groups' => ['<string>', ...],
                    'kmsKeyId' => '<string>',
                    'userIds' => ['<string>', ...],
                ],
                'ecrRepository' => [
                    'repositoryPolicy' => '<string>',
                ],
                'efsFileSystem' => [
                    'fileSystemPolicy' => '<string>',
                ],
                'iamRole' => [
                    'trustPolicy' => '<string>',
                ],
                'kmsKey' => [
                    'grants' => [
                        [
                            'constraints' => [
                                'encryptionContextEquals' => ['<string>', ...],
                                'encryptionContextSubset' => ['<string>', ...],
                            ],
                            'granteePrincipal' => '<string>',
                            'issuingAccount' => '<string>',
                            'operations' => ['<string>', ...],
                            'retiringPrincipal' => '<string>',
                        ],
                        // ...
                    ],
                    'keyPolicies' => ['<string>', ...],
                ],
                'rdsDbClusterSnapshot' => [
                    'attributes' => [
                        '<RdsDbClusterSnapshotAttributeName>' => [
                            'accountIds' => ['<string>', ...],
                        ],
                        // ...
                    ],
                    'kmsKeyId' => '<string>',
                ],
                'rdsDbSnapshot' => [
                    'attributes' => [
                        '<RdsDbSnapshotAttributeName>' => [
                            'accountIds' => ['<string>', ...],
                        ],
                        // ...
                    ],
                    'kmsKeyId' => '<string>',
                ],
                's3Bucket' => [
                    'accessPoints' => [
                        '<AccessPointArn>' => [
                            'accessPointPolicy' => '<string>',
                            'networkOrigin' => [
                                'internetConfiguration' => [
                                ],
                                'vpcConfiguration' => [
                                    'vpcId' => '<string>',
                                ],
                            ],
                            'publicAccessBlock' => [
                                'ignorePublicAcls' => true || false,
                                'restrictPublicBuckets' => true || false,
                            ],
                        ],
                        // ...
                    ],
                    'bucketAclGrants' => [
                        [
                            'grantee' => [
                                'id' => '<string>',
                                'uri' => '<string>',
                            ],
                            'permission' => 'READ|WRITE|READ_ACP|WRITE_ACP|FULL_CONTROL',
                        ],
                        // ...
                    ],
                    'bucketPolicy' => '<string>',
                    'bucketPublicAccessBlock' => [
                        'ignorePublicAcls' => true || false,
                        'restrictPublicBuckets' => true || false,
                    ],
                ],
                's3ExpressDirectoryBucket' => [
                    'accessPoints' => [
                        '<S3ExpressDirectoryAccessPointArn>' => [
                            'accessPointPolicy' => '<string>',
                            'networkOrigin' => [
                                'internetConfiguration' => [
                                ],
                                'vpcConfiguration' => [
                                    'vpcId' => '<string>',
                                ],
                            ],
                        ],
                        // ...
                    ],
                    'bucketPolicy' => '<string>',
                ],
                'secretsManagerSecret' => [
                    'kmsKeyId' => '<string>',
                    'secretPolicy' => '<string>',
                ],
                'snsTopic' => [
                    'topicPolicy' => '<string>',
                ],
                'sqsQueue' => [
                    'queuePolicy' => '<string>',
                ],
            ],
            // ...
        ],
        'createdAt' => <DateTime>,
        'id' => '<string>',
        'status' => 'COMPLETED|CREATING|FAILED',
        'statusReason' => [
            'code' => 'INTERNAL_ERROR|INVALID_CONFIGURATION',
        ],
    ],
]

Result Details

Errors

ResourceNotFoundException:

The specified resource could not be found.

InternalServerException:

Internal server error.

ValidationException:

Validation exception error.

ThrottlingException:

Throttling limit exceeded error.

AccessDeniedException:

You do not have sufficient access to perform this action.

GetAnalyzedResource

$result = $client->getAnalyzedResource([/* ... */]);
$promise = $client->getAnalyzedResourceAsync([/* ... */]);

Retrieves information about a resource that was analyzed.

Parameter Syntax

$result = $client->getAnalyzedResource([
    'analyzerArn' => '<string>', // REQUIRED
    'resourceArn' => '<string>', // REQUIRED
]);

Parameter Details

Result Syntax

[
    'resource' => [
        'actions' => ['<string>', ...],
        'analyzedAt' => <DateTime>,
        'createdAt' => <DateTime>,
        'error' => '<string>',
        'isPublic' => true || false,
        'resourceArn' => '<string>',
        'resourceOwnerAccount' => '<string>',
        'resourceType' => 'AWS::S3::Bucket|AWS::IAM::Role|AWS::SQS::Queue|AWS::Lambda::Function|AWS::Lambda::LayerVersion|AWS::KMS::Key|AWS::SecretsManager::Secret|AWS::EFS::FileSystem|AWS::EC2::Snapshot|AWS::ECR::Repository|AWS::RDS::DBSnapshot|AWS::RDS::DBClusterSnapshot|AWS::SNS::Topic|AWS::S3Express::DirectoryBucket|AWS::DynamoDB::Table|AWS::DynamoDB::Stream|AWS::IAM::User',
        'sharedVia' => ['<string>', ...],
        'status' => 'ACTIVE|ARCHIVED|RESOLVED',
        'updatedAt' => <DateTime>,
    ],
]

Result Details

Errors

ResourceNotFoundException:

The specified resource could not be found.

ValidationException:

Validation exception error.

InternalServerException:

Internal server error.

ThrottlingException:

Throttling limit exceeded error.

AccessDeniedException:

You do not have sufficient access to perform this action.

GetAnalyzer

$result = $client->getAnalyzer([/* ... */]);
$promise = $client->getAnalyzerAsync([/* ... */]);

Retrieves information about the specified analyzer.

Parameter Syntax

$result = $client->getAnalyzer([
    'analyzerName' => '<string>', // REQUIRED
]);

Parameter Details

Result Syntax

[
    'analyzer' => [
        'arn' => '<string>',
        'configuration' => [
            'internalAccess' => [
                'analysisRule' => [
                    'inclusions' => [
                        [
                            'accountIds' => ['<string>', ...],
                            'resourceArns' => ['<string>', ...],
                            'resourceTypes' => ['<string>', ...],
                        ],
                        // ...
                    ],
                ],
            ],
            'unusedAccess' => [
                'analysisRule' => [
                    'exclusions' => [
                        [
                            'accountIds' => ['<string>', ...],
                            'resourceTags' => [
                                ['<string>', ...],
                                // ...
                            ],
                        ],
                        // ...
                    ],
                ],
                'unusedAccessAge' => <integer>,
            ],
        ],
        'createdAt' => <DateTime>,
        'lastResourceAnalyzed' => '<string>',
        'lastResourceAnalyzedAt' => <DateTime>,
        'name' => '<string>',
        'status' => 'ACTIVE|CREATING|DISABLED|FAILED',
        'statusReason' => [
            'code' => 'AWS_SERVICE_ACCESS_DISABLED|DELEGATED_ADMINISTRATOR_DEREGISTERED|ORGANIZATION_DELETED|SERVICE_LINKED_ROLE_CREATION_FAILED',
        ],
        'tags' => ['<string>', ...],
        'type' => 'ACCOUNT|ORGANIZATION|ACCOUNT_UNUSED_ACCESS|ORGANIZATION_UNUSED_ACCESS|ACCOUNT_INTERNAL_ACCESS|ORGANIZATION_INTERNAL_ACCESS',
    ],
]

Result Details

Errors

ResourceNotFoundException:

The specified resource could not be found.

ValidationException:

Validation exception error.

InternalServerException:

Internal server error.

ThrottlingException:

Throttling limit exceeded error.

AccessDeniedException:

You do not have sufficient access to perform this action.

GetArchiveRule

$result = $client->getArchiveRule([/* ... */]);
$promise = $client->getArchiveRuleAsync([/* ... */]);

Retrieves information about an archive rule.

To learn about filter keys that you can use to create an archive rule, see IAM Access Analyzer filter keys in the IAM User Guide.

Parameter Syntax

$result = $client->getArchiveRule([
    'analyzerName' => '<string>', // REQUIRED
    'ruleName' => '<string>', // REQUIRED
]);

Parameter Details

Result Syntax

[
    'archiveRule' => [
        'createdAt' => <DateTime>,
        'filter' => [
            '<String>' => [
                'contains' => ['<string>', ...],
                'eq' => ['<string>', ...],
                'exists' => true || false,
                'neq' => ['<string>', ...],
            ],
            // ...
        ],
        'ruleName' => '<string>',
        'updatedAt' => <DateTime>,
    ],
]

Result Details

Errors

ResourceNotFoundException:

The specified resource could not be found.

ValidationException:

Validation exception error.

InternalServerException:

Internal server error.

ThrottlingException:

Throttling limit exceeded error.

AccessDeniedException:

You do not have sufficient access to perform this action.

GetFinding

$result = $client->getFinding([/* ... */]);
$promise = $client->getFindingAsync([/* ... */]);

Retrieves information about the specified finding. GetFinding and GetFindingV2 both use access-analyzer:GetFinding in the Action element of an IAM policy statement. You must have permission to perform the access-analyzer:GetFinding action.

Parameter Syntax

$result = $client->getFinding([
    'analyzerArn' => '<string>', // REQUIRED
    'id' => '<string>', // REQUIRED
]);

Parameter Details

Result Syntax

[
    'finding' => [
        'action' => ['<string>', ...],
        'analyzedAt' => <DateTime>,
        'condition' => ['<string>', ...],
        'createdAt' => <DateTime>,
        'error' => '<string>',
        'id' => '<string>',
        'isPublic' => true || false,
        'principal' => ['<string>', ...],
        'resource' => '<string>',
        'resourceControlPolicyRestriction' => 'APPLICABLE|FAILED_TO_EVALUATE_RCP|NOT_APPLICABLE|APPLIED',
        'resourceOwnerAccount' => '<string>',
        'resourceType' => 'AWS::S3::Bucket|AWS::IAM::Role|AWS::SQS::Queue|AWS::Lambda::Function|AWS::Lambda::LayerVersion|AWS::KMS::Key|AWS::SecretsManager::Secret|AWS::EFS::FileSystem|AWS::EC2::Snapshot|AWS::ECR::Repository|AWS::RDS::DBSnapshot|AWS::RDS::DBClusterSnapshot|AWS::SNS::Topic|AWS::S3Express::DirectoryBucket|AWS::DynamoDB::Table|AWS::DynamoDB::Stream|AWS::IAM::User',
        'sources' => [
            [
                'detail' => [
                    'accessPointAccount' => '<string>',
                    'accessPointArn' => '<string>',
                ],
                'type' => 'POLICY|BUCKET_ACL|S3_ACCESS_POINT|S3_ACCESS_POINT_ACCOUNT',
            ],
            // ...
        ],
        'status' => 'ACTIVE|ARCHIVED|RESOLVED',
        'updatedAt' => <DateTime>,
    ],
]

Result Details

Errors

ResourceNotFoundException:

The specified resource could not be found.

ValidationException:

Validation exception error.

InternalServerException:

Internal server error.

ThrottlingException:

Throttling limit exceeded error.

AccessDeniedException:

You do not have sufficient access to perform this action.

GetFindingRecommendation

$result = $client->getFindingRecommendation([/* ... */]);
$promise = $client->getFindingRecommendationAsync([/* ... */]);

Retrieves information about a finding recommendation for the specified analyzer.

Parameter Syntax

$result = $client->getFindingRecommendation([
    'analyzerArn' => '<string>', // REQUIRED
    'id' => '<string>', // REQUIRED
    'maxResults' => <integer>,
    'nextToken' => '<string>',
]);

Parameter Details

Result Syntax

[
    'completedAt' => <DateTime>,
    'error' => [
        'code' => '<string>',
        'message' => '<string>',
    ],
    'nextToken' => '<string>',
    'recommendationType' => 'UnusedPermissionRecommendation',
    'recommendedSteps' => [
        [
            'unusedPermissionsRecommendedStep' => [
                'existingPolicyId' => '<string>',
                'policyUpdatedAt' => <DateTime>,
                'recommendedAction' => 'CREATE_POLICY|DETACH_POLICY',
                'recommendedPolicy' => '<string>',
            ],
        ],
        // ...
    ],
    'resourceArn' => '<string>',
    'startedAt' => <DateTime>,
    'status' => 'SUCCEEDED|FAILED|IN_PROGRESS',
]

Result Details

Errors

ResourceNotFoundException:

The specified resource could not be found.

ValidationException:

Validation exception error.

InternalServerException:

Internal server error.

ThrottlingException:

Throttling limit exceeded error.

AccessDeniedException:

You do not have sufficient access to perform this action.

Examples

Example 1: Successfully fetched finding recommendation

$result = $client->getFindingRecommendation([
    'analyzerArn' => 'arn:aws:access-analyzer:us-east-1:111122223333:analyzer/a',
    'id' => 'finding-id',
    'maxResults' => 3,
    'nextToken' => 'token',
]);

Result syntax:

[
    'completedAt' => ,
    'recommendationType' => 'UnusedPermissionRecommendation',
    'recommendedSteps' => [
        [
            'unusedPermissionsRecommendedStep' => [
                'existingPolicyId' => 'policy-id',
                'recommendedAction' => 'DETACH_POLICY',
            ],
        ],
        [
            'unusedPermissionsRecommendedStep' => [
                'existingPolicyId' => 'policy-id',
                'recommendedAction' => 'CREATE_POLICY',
                'recommendedPolicy' => 'policy-content',
            ],
        ],
    ],
    'resourceArn' => 'arn:aws:iam::111122223333:role/test',
    'startedAt' => ,
    'status' => 'SUCCEEDED',
]

Example 2: In progress finding recommendation

$result = $client->getFindingRecommendation([
    'analyzerArn' => 'arn:aws:access-analyzer:us-east-1:111122223333:analyzer/a',
    'id' => 'finding-id',
    'maxResults' => 3,
]);

Result syntax:

[
    'recommendationType' => 'UnusedPermissionRecommendation',
    'resourceArn' => 'arn:aws:iam::111122223333:role/test',
    'startedAt' => ,
    'status' => 'IN_PROGRESS',
]

Example 3: Failed finding recommendation

$result = $client->getFindingRecommendation([
    'analyzerArn' => 'arn:aws:access-analyzer:us-east-1:111122223333:analyzer/a',
    'id' => 'finding-id',
    'maxResults' => 3,
]);

Result syntax:

[
    'completedAt' => ,
    'error' => [
        'code' => 'SERVICE_ERROR',
        'message' => 'Service error. Please try again.',
    ],
    'recommendationType' => 'UnusedPermissionRecommendation',
    'resourceArn' => 'arn:aws:iam::111122223333:role/test',
    'startedAt' => ,
    'status' => 'FAILED',
]

Example 4: Failed field validation for id value

$result = $client->getFindingRecommendation([
    'analyzerArn' => 'arn:aws:access-analyzer:us-east-1:111122223333:analyzer/a',
    'id' => '!',
]);

GetFindingV2

$result = $client->getFindingV2([/* ... */]);
$promise = $client->getFindingV2Async([/* ... */]);

Retrieves information about the specified finding. GetFinding and GetFindingV2 both use access-analyzer:GetFinding in the Action element of an IAM policy statement. You must have permission to perform the access-analyzer:GetFinding action.

Parameter Syntax

$result = $client->getFindingV2([
    'analyzerArn' => '<string>', // REQUIRED
    'id' => '<string>', // REQUIRED
    'maxResults' => <integer>,
    'nextToken' => '<string>',
]);

Parameter Details

Result Syntax

[
    'analyzedAt' => <DateTime>,
    'createdAt' => <DateTime>,
    'error' => '<string>',
    'findingDetails' => [
        [
            'externalAccessDetails' => [
                'action' => ['<string>', ...],
                'condition' => ['<string>', ...],
                'isPublic' => true || false,
                'principal' => ['<string>', ...],
                'resourceControlPolicyRestriction' => 'APPLICABLE|FAILED_TO_EVALUATE_RCP|NOT_APPLICABLE|APPLIED',
                'sources' => [
                    [
                        'detail' => [
                            'accessPointAccount' => '<string>',
                            'accessPointArn' => '<string>',
                        ],
                        'type' => 'POLICY|BUCKET_ACL|S3_ACCESS_POINT|S3_ACCESS_POINT_ACCOUNT',
                    ],
                    // ...
                ],
            ],
            'internalAccessDetails' => [
                'accessType' => 'INTRA_ACCOUNT|INTRA_ORG',
                'action' => ['<string>', ...],
                'condition' => ['<string>', ...],
                'principal' => ['<string>', ...],
                'principalOwnerAccount' => '<string>',
                'principalType' => 'IAM_ROLE|IAM_USER',
                'resourceControlPolicyRestriction' => 'APPLICABLE|FAILED_TO_EVALUATE_RCP|NOT_APPLICABLE|APPLIED',
                'serviceControlPolicyRestriction' => 'APPLICABLE|FAILED_TO_EVALUATE_SCP|NOT_APPLICABLE|APPLIED',
                'sources' => [
                    [
                        'detail' => [
                            'accessPointAccount' => '<string>',
                            'accessPointArn' => '<string>',
                        ],
                        'type' => 'POLICY|BUCKET_ACL|S3_ACCESS_POINT|S3_ACCESS_POINT_ACCOUNT',
                    ],
                    // ...
                ],
            ],
            'unusedIamRoleDetails' => [
                'lastAccessed' => <DateTime>,
            ],
            'unusedIamUserAccessKeyDetails' => [
                'accessKeyId' => '<string>',
                'lastAccessed' => <DateTime>,
            ],
            'unusedIamUserPasswordDetails' => [
                'lastAccessed' => <DateTime>,
            ],
            'unusedPermissionDetails' => [
                'actions' => [
                    [
                        'action' => '<string>',
                        'lastAccessed' => <DateTime>,
                    ],
                    // ...
                ],
                'lastAccessed' => <DateTime>,
                'serviceNamespace' => '<string>',
            ],
        ],
        // ...
    ],
    'findingType' => 'ExternalAccess|UnusedIAMRole|UnusedIAMUserAccessKey|UnusedIAMUserPassword|UnusedPermission|InternalAccess',
    'id' => '<string>',
    'nextToken' => '<string>',
    'resource' => '<string>',
    'resourceOwnerAccount' => '<string>',
    'resourceType' => 'AWS::S3::Bucket|AWS::IAM::Role|AWS::SQS::Queue|AWS::Lambda::Function|AWS::Lambda::LayerVersion|AWS::KMS::Key|AWS::SecretsManager::Secret|AWS::EFS::FileSystem|AWS::EC2::Snapshot|AWS::ECR::Repository|AWS::RDS::DBSnapshot|AWS::RDS::DBClusterSnapshot|AWS::SNS::Topic|AWS::S3Express::DirectoryBucket|AWS::DynamoDB::Table|AWS::DynamoDB::Stream|AWS::IAM::User',
    'status' => 'ACTIVE|ARCHIVED|RESOLVED',
    'updatedAt' => <DateTime>,
]

Result Details

Errors

ResourceNotFoundException:

The specified resource could not be found.

ValidationException:

Validation exception error.

InternalServerException:

Internal server error.

ThrottlingException:

Throttling limit exceeded error.

AccessDeniedException:

You do not have sufficient access to perform this action.

GetFindingsStatistics

$result = $client->getFindingsStatistics([/* ... */]);
$promise = $client->getFindingsStatisticsAsync([/* ... */]);

Retrieves a list of aggregated finding statistics for an external access or unused access analyzer.

Parameter Syntax

$result = $client->getFindingsStatistics([
    'analyzerArn' => '<string>', // REQUIRED
]);

Parameter Details

Result Syntax

[
    'findingsStatistics' => [
        [
            'externalAccessFindingsStatistics' => [
                'resourceTypeStatistics' => [
                    '<ResourceType>' => [
                        'totalActiveCrossAccount' => <integer>,
                        'totalActivePublic' => <integer>,
                    ],
                    // ...
                ],
                'totalActiveFindings' => <integer>,
                'totalArchivedFindings' => <integer>,
                'totalResolvedFindings' => <integer>,
            ],
            'internalAccessFindingsStatistics' => [
                'resourceTypeStatistics' => [
                    '<ResourceType>' => [
                        'totalActiveFindings' => <integer>,
                        'totalArchivedFindings' => <integer>,
                        'totalResolvedFindings' => <integer>,
                    ],
                    // ...
                ],
                'totalActiveFindings' => <integer>,
                'totalArchivedFindings' => <integer>,
                'totalResolvedFindings' => <integer>,
            ],
            'unusedAccessFindingsStatistics' => [
                'topAccounts' => [
                    [
                        'account' => '<string>',
                        'details' => [<integer>, ...],
                        'numberOfActiveFindings' => <integer>,
                    ],
                    // ...
                ],
                'totalActiveFindings' => <integer>,
                'totalArchivedFindings' => <integer>,
                'totalResolvedFindings' => <integer>,
                'unusedAccessTypeStatistics' => [
                    [
                        'total' => <integer>,
                        'unusedAccessType' => '<string>',
                    ],
                    // ...
                ],
            ],
        ],
        // ...
    ],
    'lastUpdatedAt' => <DateTime>,
]

Result Details

Errors

ResourceNotFoundException:

The specified resource could not be found.

ValidationException:

Validation exception error.

InternalServerException:

Internal server error.

ThrottlingException:

Throttling limit exceeded error.

AccessDeniedException:

You do not have sufficient access to perform this action.

GetGeneratedPolicy

$result = $client->getGeneratedPolicy([/* ... */]);
$promise = $client->getGeneratedPolicyAsync([/* ... */]);

Retrieves the policy that was generated using StartPolicyGeneration.

Parameter Syntax

$result = $client->getGeneratedPolicy([
    'includeResourcePlaceholders' => true || false,
    'includeServiceLevelTemplate' => true || false,
    'jobId' => '<string>', // REQUIRED
]);

Parameter Details

Result Syntax

[
    'generatedPolicyResult' => [
        'generatedPolicies' => [
            [
                'policy' => '<string>',
            ],
            // ...
        ],
        'properties' => [
            'cloudTrailProperties' => [
                'endTime' => <DateTime>,
                'startTime' => <DateTime>,
                'trailProperties' => [
                    [
                        'allRegions' => true || false,
                        'cloudTrailArn' => '<string>',
                        'regions' => ['<string>', ...],
                    ],
                    // ...
                ],
            ],
            'isComplete' => true || false,
            'principalArn' => '<string>',
        ],
    ],
    'jobDetails' => [
        'completedOn' => <DateTime>,
        'jobError' => [
            'code' => 'AUTHORIZATION_ERROR|RESOURCE_NOT_FOUND_ERROR|SERVICE_QUOTA_EXCEEDED_ERROR|SERVICE_ERROR',
            'message' => '<string>',
        ],
        'jobId' => '<string>',
        'startedOn' => <DateTime>,
        'status' => 'IN_PROGRESS|SUCCEEDED|FAILED|CANCELED',
    ],
]

Result Details

Errors

InternalServerException:

Internal server error.

ValidationException:

Validation exception error.

ThrottlingException:

Throttling limit exceeded error.

AccessDeniedException:

You do not have sufficient access to perform this action.

ListAccessPreviewFindings

$result = $client->listAccessPreviewFindings([/* ... */]);
$promise = $client->listAccessPreviewFindingsAsync([/* ... */]);

Retrieves a list of access preview findings generated by the specified access preview.

Parameter Syntax

$result = $client->listAccessPreviewFindings([
    'accessPreviewId' => '<string>', // REQUIRED
    'analyzerArn' => '<string>', // REQUIRED
    'filter' => [
        '<String>' => [
            'contains' => ['<string>', ...],
            'eq' => ['<string>', ...],
            'exists' => true || false,
            'neq' => ['<string>', ...],
        ],
        // ...
    ],
    'maxResults' => <integer>,
    'nextToken' => '<string>',
]);

Parameter Details

Result Syntax

[
    'findings' => [
        [
            'action' => ['<string>', ...],
            'changeType' => 'CHANGED|NEW|UNCHANGED',
            'condition' => ['<string>', ...],
            'createdAt' => <DateTime>,
            'error' => '<string>',
            'existingFindingId' => '<string>',
            'existingFindingStatus' => 'ACTIVE|ARCHIVED|RESOLVED',
            'id' => '<string>',
            'isPublic' => true || false,
            'principal' => ['<string>', ...],
            'resource' => '<string>',
            'resourceControlPolicyRestriction' => 'APPLICABLE|FAILED_TO_EVALUATE_RCP|NOT_APPLICABLE|APPLIED',
            'resourceOwnerAccount' => '<string>',
            'resourceType' => 'AWS::S3::Bucket|AWS::IAM::Role|AWS::SQS::Queue|AWS::Lambda::Function|AWS::Lambda::LayerVersion|AWS::KMS::Key|AWS::SecretsManager::Secret|AWS::EFS::FileSystem|AWS::EC2::Snapshot|AWS::ECR::Repository|AWS::RDS::DBSnapshot|AWS::RDS::DBClusterSnapshot|AWS::SNS::Topic|AWS::S3Express::DirectoryBucket|AWS::DynamoDB::Table|AWS::DynamoDB::Stream|AWS::IAM::User',
            'sources' => [
                [
                    'detail' => [
                        'accessPointAccount' => '<string>',
                        'accessPointArn' => '<string>',
                    ],
                    'type' => 'POLICY|BUCKET_ACL|S3_ACCESS_POINT|S3_ACCESS_POINT_ACCOUNT',
                ],
                // ...
            ],
            'status' => 'ACTIVE|ARCHIVED|RESOLVED',
        ],
        // ...
    ],
    'nextToken' => '<string>',
]

Result Details

Errors

ConflictException:

A conflict exception error.

ResourceNotFoundException:

The specified resource could not be found.

InternalServerException:

Internal server error.

ValidationException:

Validation exception error.

ThrottlingException:

Throttling limit exceeded error.

AccessDeniedException:

You do not have sufficient access to perform this action.

ListAccessPreviews

$result = $client->listAccessPreviews([/* ... */]);
$promise = $client->listAccessPreviewsAsync([/* ... */]);

Retrieves a list of access previews for the specified analyzer.

Parameter Syntax

$result = $client->listAccessPreviews([
    'analyzerArn' => '<string>', // REQUIRED
    'maxResults' => <integer>,
    'nextToken' => '<string>',
]);

Parameter Details

Result Syntax

[
    'accessPreviews' => [
        [
            'analyzerArn' => '<string>',
            'createdAt' => <DateTime>,
            'id' => '<string>',
            'status' => 'COMPLETED|CREATING|FAILED',
            'statusReason' => [
                'code' => 'INTERNAL_ERROR|INVALID_CONFIGURATION',
            ],
        ],
        // ...
    ],
    'nextToken' => '<string>',
]

Result Details

Errors

ResourceNotFoundException:

The specified resource could not be found.

InternalServerException:

Internal server error.

ValidationException:

Validation exception error.

ThrottlingException:

Throttling limit exceeded error.

AccessDeniedException:

You do not have sufficient access to perform this action.

ListAnalyzedResources

$result = $client->listAnalyzedResources([/* ... */]);
$promise = $client->listAnalyzedResourcesAsync([/* ... */]);

Retrieves a list of resources of the specified type that have been analyzed by the specified analyzer.

Parameter Syntax

$result = $client->listAnalyzedResources([
    'analyzerArn' => '<string>', // REQUIRED
    'maxResults' => <integer>,
    'nextToken' => '<string>',
    'resourceType' => 'AWS::S3::Bucket|AWS::IAM::Role|AWS::SQS::Queue|AWS::Lambda::Function|AWS::Lambda::LayerVersion|AWS::KMS::Key|AWS::SecretsManager::Secret|AWS::EFS::FileSystem|AWS::EC2::Snapshot|AWS::ECR::Repository|AWS::RDS::DBSnapshot|AWS::RDS::DBClusterSnapshot|AWS::SNS::Topic|AWS::S3Express::DirectoryBucket|AWS::DynamoDB::Table|AWS::DynamoDB::Stream|AWS::IAM::User',
]);

Parameter Details

Result Syntax

[
    'analyzedResources' => [
        [
            'resourceArn' => '<string>',
            'resourceOwnerAccount' => '<string>',
            'resourceType' => 'AWS::S3::Bucket|AWS::IAM::Role|AWS::SQS::Queue|AWS::Lambda::Function|AWS::Lambda::LayerVersion|AWS::KMS::Key|AWS::SecretsManager::Secret|AWS::EFS::FileSystem|AWS::EC2::Snapshot|AWS::ECR::Repository|AWS::RDS::DBSnapshot|AWS::RDS::DBClusterSnapshot|AWS::SNS::Topic|AWS::S3Express::DirectoryBucket|AWS::DynamoDB::Table|AWS::DynamoDB::Stream|AWS::IAM::User',
        ],
        // ...
    ],
    'nextToken' => '<string>',
]

Result Details

Errors

ResourceNotFoundException:

The specified resource could not be found.

ValidationException:

Validation exception error.

InternalServerException:

Internal server error.

ThrottlingException:

Throttling limit exceeded error.

AccessDeniedException:

You do not have sufficient access to perform this action.

ListAnalyzers

$result = $client->listAnalyzers([/* ... */]);
$promise = $client->listAnalyzersAsync([/* ... */]);

Retrieves a list of analyzers.

Parameter Syntax

$result = $client->listAnalyzers([
    'maxResults' => <integer>,
    'nextToken' => '<string>',
    'type' => 'ACCOUNT|ORGANIZATION|ACCOUNT_UNUSED_ACCESS|ORGANIZATION_UNUSED_ACCESS|ACCOUNT_INTERNAL_ACCESS|ORGANIZATION_INTERNAL_ACCESS',
]);

Parameter Details

Result Syntax

[
    'analyzers' => [
        [
            'arn' => '<string>',
            'configuration' => [
                'internalAccess' => [
                    'analysisRule' => [
                        'inclusions' => [
                            [
                                'accountIds' => ['<string>', ...],
                                'resourceArns' => ['<string>', ...],
                                'resourceTypes' => ['<string>', ...],
                            ],
                            // ...
                        ],
                    ],
                ],
                'unusedAccess' => [
                    'analysisRule' => [
                        'exclusions' => [
                            [
                                'accountIds' => ['<string>', ...],
                                'resourceTags' => [
                                    ['<string>', ...],
                                    // ...
                                ],
                            ],
                            // ...
                        ],
                    ],
                    'unusedAccessAge' => <integer>,
                ],
            ],
            'createdAt' => <DateTime>,
            'lastResourceAnalyzed' => '<string>',
            'lastResourceAnalyzedAt' => <DateTime>,
            'name' => '<string>',
            'status' => 'ACTIVE|CREATING|DISABLED|FAILED',
            'statusReason' => [
                'code' => 'AWS_SERVICE_ACCESS_DISABLED|DELEGATED_ADMINISTRATOR_DEREGISTERED|ORGANIZATION_DELETED|SERVICE_LINKED_ROLE_CREATION_FAILED',
            ],
            'tags' => ['<string>', ...],
            'type' => 'ACCOUNT|ORGANIZATION|ACCOUNT_UNUSED_ACCESS|ORGANIZATION_UNUSED_ACCESS|ACCOUNT_INTERNAL_ACCESS|ORGANIZATION_INTERNAL_ACCESS',
        ],
        // ...
    ],
    'nextToken' => '<string>',
]

Result Details

Errors

ValidationException:

Validation exception error.

InternalServerException:

Internal server error.

ThrottlingException:

Throttling limit exceeded error.

AccessDeniedException:

You do not have sufficient access to perform this action.

ListArchiveRules

$result = $client->listArchiveRules([/* ... */]);
$promise = $client->listArchiveRulesAsync([/* ... */]);

Retrieves a list of archive rules created for the specified analyzer.

Parameter Syntax

$result = $client->listArchiveRules([
    'analyzerName' => '<string>', // REQUIRED
    'maxResults' => <integer>,
    'nextToken' => '<string>',
]);

Parameter Details

Result Syntax

[
    'archiveRules' => [
        [
            'createdAt' => <DateTime>,
            'filter' => [
                '<String>' => [
                    'contains' => ['<string>', ...],
                    'eq' => ['<string>', ...],
                    'exists' => true || false,
                    'neq' => ['<string>', ...],
                ],
                // ...
            ],
            'ruleName' => '<string>',
            'updatedAt' => <DateTime>,
        ],
        // ...
    ],
    'nextToken' => '<string>',
]

Result Details

Errors

ValidationException:

Validation exception error.

InternalServerException:

Internal server error.

ThrottlingException:

Throttling limit exceeded error.

AccessDeniedException:

You do not have sufficient access to perform this action.

ListFindings

$result = $client->listFindings([/* ... */]);
$promise = $client->listFindingsAsync([/* ... */]);

Retrieves a list of findings generated by the specified analyzer. ListFindings and ListFindingsV2 both use access-analyzer:ListFindings in the Action element of an IAM policy statement. You must have permission to perform the access-analyzer:ListFindings action.

To learn about filter keys that you can use to retrieve a list of findings, see IAM Access Analyzer filter keys in the IAM User Guide.

Parameter Syntax

$result = $client->listFindings([
    'analyzerArn' => '<string>', // REQUIRED
    'filter' => [
        '<String>' => [
            'contains' => ['<string>', ...],
            'eq' => ['<string>', ...],
            'exists' => true || false,
            'neq' => ['<string>', ...],
        ],
        // ...
    ],
    'maxResults' => <integer>,
    'nextToken' => '<string>',
    'sort' => [
        'attributeName' => '<string>',
        'orderBy' => 'ASC|DESC',
    ],
]);

Parameter Details

Result Syntax

[
    'findings' => [
        [
            'action' => ['<string>', ...],
            'analyzedAt' => <DateTime>,
            'condition' => ['<string>', ...],
            'createdAt' => <DateTime>,
            'error' => '<string>',
            'id' => '<string>',
            'isPublic' => true || false,
            'principal' => ['<string>', ...],
            'resource' => '<string>',
            'resourceControlPolicyRestriction' => 'APPLICABLE|FAILED_TO_EVALUATE_RCP|NOT_APPLICABLE|APPLIED',
            'resourceOwnerAccount' => '<string>',
            'resourceType' => 'AWS::S3::Bucket|AWS::IAM::Role|AWS::SQS::Queue|AWS::Lambda::Function|AWS::Lambda::LayerVersion|AWS::KMS::Key|AWS::SecretsManager::Secret|AWS::EFS::FileSystem|AWS::EC2::Snapshot|AWS::ECR::Repository|AWS::RDS::DBSnapshot|AWS::RDS::DBClusterSnapshot|AWS::SNS::Topic|AWS::S3Express::DirectoryBucket|AWS::DynamoDB::Table|AWS::DynamoDB::Stream|AWS::IAM::User',
            'sources' => [
                [
                    'detail' => [
                        'accessPointAccount' => '<string>',
                        'accessPointArn' => '<string>',
                    ],
                    'type' => 'POLICY|BUCKET_ACL|S3_ACCESS_POINT|S3_ACCESS_POINT_ACCOUNT',
                ],
                // ...
            ],
            'status' => 'ACTIVE|ARCHIVED|RESOLVED',
            'updatedAt' => <DateTime>,
        ],
        // ...
    ],
    'nextToken' => '<string>',
]

Result Details

Errors

ResourceNotFoundException:

The specified resource could not be found.

ValidationException:

Validation exception error.

InternalServerException:

Internal server error.

ThrottlingException:

Throttling limit exceeded error.

AccessDeniedException:

You do not have sufficient access to perform this action.

ListFindingsV2

$result = $client->listFindingsV2([/* ... */]);
$promise = $client->listFindingsV2Async([/* ... */]);

Retrieves a list of findings generated by the specified analyzer. ListFindings and ListFindingsV2 both use access-analyzer:ListFindings in the Action element of an IAM policy statement. You must have permission to perform the access-analyzer:ListFindings action.

To learn about filter keys that you can use to retrieve a list of findings, see IAM Access Analyzer filter keys in the IAM User Guide.

Parameter Syntax

$result = $client->listFindingsV2([
    'analyzerArn' => '<string>', // REQUIRED
    'filter' => [
        '<String>' => [
            'contains' => ['<string>', ...],
            'eq' => ['<string>', ...],
            'exists' => true || false,
            'neq' => ['<string>', ...],
        ],
        // ...
    ],
    'maxResults' => <integer>,
    'nextToken' => '<string>',
    'sort' => [
        'attributeName' => '<string>',
        'orderBy' => 'ASC|DESC',
    ],
]);

Parameter Details

Result Syntax

[
    'findings' => [
        [
            'analyzedAt' => <DateTime>,
            'createdAt' => <DateTime>,
            'error' => '<string>',
            'findingType' => 'ExternalAccess|UnusedIAMRole|UnusedIAMUserAccessKey|UnusedIAMUserPassword|UnusedPermission|InternalAccess',
            'id' => '<string>',
            'resource' => '<string>',
            'resourceOwnerAccount' => '<string>',
            'resourceType' => 'AWS::S3::Bucket|AWS::IAM::Role|AWS::SQS::Queue|AWS::Lambda::Function|AWS::Lambda::LayerVersion|AWS::KMS::Key|AWS::SecretsManager::Secret|AWS::EFS::FileSystem|AWS::EC2::Snapshot|AWS::ECR::Repository|AWS::RDS::DBSnapshot|AWS::RDS::DBClusterSnapshot|AWS::SNS::Topic|AWS::S3Express::DirectoryBucket|AWS::DynamoDB::Table|AWS::DynamoDB::Stream|AWS::IAM::User',
            'status' => 'ACTIVE|ARCHIVED|RESOLVED',
            'updatedAt' => <DateTime>,
        ],
        // ...
    ],
    'nextToken' => '<string>',
]

Result Details

Errors

ResourceNotFoundException:

The specified resource could not be found.

ValidationException:

Validation exception error.

InternalServerException:

Internal server error.

ThrottlingException:

Throttling limit exceeded error.

AccessDeniedException:

You do not have sufficient access to perform this action.

ListPolicyGenerations

$result = $client->listPolicyGenerations([/* ... */]);
$promise = $client->listPolicyGenerationsAsync([/* ... */]);

Lists all of the policy generations requested in the last seven days.

Parameter Syntax

$result = $client->listPolicyGenerations([
    'maxResults' => <integer>,
    'nextToken' => '<string>',
    'principalArn' => '<string>',
]);

Parameter Details

Result Syntax

[
    'nextToken' => '<string>',
    'policyGenerations' => [
        [
            'completedOn' => <DateTime>,
            'jobId' => '<string>',
            'principalArn' => '<string>',
            'startedOn' => <DateTime>,
            'status' => 'IN_PROGRESS|SUCCEEDED|FAILED|CANCELED',
        ],
        // ...
    ],
]

Result Details

Errors

InternalServerException:

Internal server error.

ValidationException:

Validation exception error.

ThrottlingException:

Throttling limit exceeded error.

AccessDeniedException:

You do not have sufficient access to perform this action.

ListTagsForResource

$result = $client->listTagsForResource([/* ... */]);
$promise = $client->listTagsForResourceAsync([/* ... */]);

Retrieves a list of tags applied to the specified resource.

Parameter Syntax

$result = $client->listTagsForResource([
    'resourceArn' => '<string>', // REQUIRED
]);

Parameter Details

Result Syntax

[
    'tags' => ['<string>', ...],
]

Result Details

Errors

ResourceNotFoundException:

The specified resource could not be found.

InternalServerException:

Internal server error.

ValidationException:

Validation exception error.

ThrottlingException:

Throttling limit exceeded error.

AccessDeniedException:

You do not have sufficient access to perform this action.

StartPolicyGeneration

$result = $client->startPolicyGeneration([/* ... */]);
$promise = $client->startPolicyGenerationAsync([/* ... */]);

Starts the policy generation request.

Parameter Syntax

$result = $client->startPolicyGeneration([
    'clientToken' => '<string>',
    'cloudTrailDetails' => [
        'accessRole' => '<string>', // REQUIRED
        'endTime' => <integer || string || DateTime>,
        'startTime' => <integer || string || DateTime>, // REQUIRED
        'trails' => [ // REQUIRED
            [
                'allRegions' => true || false,
                'cloudTrailArn' => '<string>', // REQUIRED
                'regions' => ['<string>', ...],
            ],
            // ...
        ],
    ],
    'policyGenerationDetails' => [ // REQUIRED
        'principalArn' => '<string>', // REQUIRED
    ],
]);

Parameter Details

Result Syntax

[
    'jobId' => '<string>',
]

Result Details

Errors

ConflictException:

A conflict exception error.

InternalServerException:

Internal server error.

ValidationException:

Validation exception error.

ServiceQuotaExceededException:

Service quote met error.

ThrottlingException:

Throttling limit exceeded error.

AccessDeniedException:

You do not have sufficient access to perform this action.

StartResourceScan

$result = $client->startResourceScan([/* ... */]);
$promise = $client->startResourceScanAsync([/* ... */]);

Immediately starts a scan of the policies applied to the specified resource.

Parameter Syntax

$result = $client->startResourceScan([
    'analyzerArn' => '<string>', // REQUIRED
    'resourceArn' => '<string>', // REQUIRED
    'resourceOwnerAccount' => '<string>',
]);

Parameter Details

Result Syntax

[]

Result Details

Errors

ResourceNotFoundException:

The specified resource could not be found.

ValidationException:

Validation exception error.

InternalServerException:

Internal server error.

ThrottlingException:

Throttling limit exceeded error.

AccessDeniedException:

You do not have sufficient access to perform this action.

TagResource

$result = $client->tagResource([/* ... */]);
$promise = $client->tagResourceAsync([/* ... */]);

Adds a tag to the specified resource.

Parameter Syntax

$result = $client->tagResource([
    'resourceArn' => '<string>', // REQUIRED
    'tags' => ['<string>', ...], // REQUIRED
]);

Parameter Details

Result Syntax

[]

Result Details

Errors

ResourceNotFoundException:

The specified resource could not be found.

InternalServerException:

Internal server error.

ValidationException:

Validation exception error.

ThrottlingException:

Throttling limit exceeded error.

AccessDeniedException:

You do not have sufficient access to perform this action.

UntagResource

$result = $client->untagResource([/* ... */]);
$promise = $client->untagResourceAsync([/* ... */]);

Removes a tag from the specified resource.

Parameter Syntax

$result = $client->untagResource([
    'resourceArn' => '<string>', // REQUIRED
    'tagKeys' => ['<string>', ...], // REQUIRED
]);

Parameter Details

Result Syntax

[]

Result Details

Errors

ResourceNotFoundException:

The specified resource could not be found.

InternalServerException:

Internal server error.

ValidationException:

Validation exception error.

ThrottlingException:

Throttling limit exceeded error.

AccessDeniedException:

You do not have sufficient access to perform this action.

UpdateAnalyzer

$result = $client->updateAnalyzer([/* ... */]);
$promise = $client->updateAnalyzerAsync([/* ... */]);

Modifies the configuration of an existing analyzer.

Parameter Syntax

$result = $client->updateAnalyzer([
    'analyzerName' => '<string>', // REQUIRED
    'configuration' => [
        'internalAccess' => [
            'analysisRule' => [
                'inclusions' => [
                    [
                        'accountIds' => ['<string>', ...],
                        'resourceArns' => ['<string>', ...],
                        'resourceTypes' => ['<string>', ...],
                    ],
                    // ...
                ],
            ],
        ],
        'unusedAccess' => [
            'analysisRule' => [
                'exclusions' => [
                    [
                        'accountIds' => ['<string>', ...],
                        'resourceTags' => [
                            ['<string>', ...],
                            // ...
                        ],
                    ],
                    // ...
                ],
            ],
            'unusedAccessAge' => <integer>,
        ],
    ],
]);

Parameter Details

Result Syntax

[
    'configuration' => [
        'internalAccess' => [
            'analysisRule' => [
                'inclusions' => [
                    [
                        'accountIds' => ['<string>', ...],
                        'resourceArns' => ['<string>', ...],
                        'resourceTypes' => ['<string>', ...],
                    ],
                    // ...
                ],
            ],
        ],
        'unusedAccess' => [
            'analysisRule' => [
                'exclusions' => [
                    [
                        'accountIds' => ['<string>', ...],
                        'resourceTags' => [
                            ['<string>', ...],
                            // ...
                        ],
                    ],
                    // ...
                ],
            ],
            'unusedAccessAge' => <integer>,
        ],
    ],
]

Result Details

Errors

ResourceNotFoundException:

The specified resource could not be found.

ConflictException:

A conflict exception error.

ValidationException:

Validation exception error.

InternalServerException:

Internal server error.

ThrottlingException:

Throttling limit exceeded error.

AccessDeniedException:

You do not have sufficient access to perform this action.

UpdateArchiveRule

$result = $client->updateArchiveRule([/* ... */]);
$promise = $client->updateArchiveRuleAsync([/* ... */]);

Updates the criteria and values for the specified archive rule.

Parameter Syntax

$result = $client->updateArchiveRule([
    'analyzerName' => '<string>', // REQUIRED
    'clientToken' => '<string>',
    'filter' => [ // REQUIRED
        '<String>' => [
            'contains' => ['<string>', ...],
            'eq' => ['<string>', ...],
            'exists' => true || false,
            'neq' => ['<string>', ...],
        ],
        // ...
    ],
    'ruleName' => '<string>', // REQUIRED
]);

Parameter Details

Result Syntax

[]

Result Details

Errors

ResourceNotFoundException:

The specified resource could not be found.

ValidationException:

Validation exception error.

InternalServerException:

Internal server error.

ThrottlingException:

Throttling limit exceeded error.

AccessDeniedException:

You do not have sufficient access to perform this action.

UpdateFindings

$result = $client->updateFindings([/* ... */]);
$promise = $client->updateFindingsAsync([/* ... */]);

Updates the status for the specified findings.

Parameter Syntax

$result = $client->updateFindings([
    'analyzerArn' => '<string>', // REQUIRED
    'clientToken' => '<string>',
    'ids' => ['<string>', ...],
    'resourceArn' => '<string>',
    'status' => 'ACTIVE|ARCHIVED', // REQUIRED
]);

Parameter Details

Result Syntax

[]

Result Details

Errors

ResourceNotFoundException:

The specified resource could not be found.

ValidationException:

Validation exception error.

InternalServerException:

Internal server error.

ThrottlingException:

Throttling limit exceeded error.

AccessDeniedException:

You do not have sufficient access to perform this action.

ValidatePolicy

$result = $client->validatePolicy([/* ... */]);
$promise = $client->validatePolicyAsync([/* ... */]);

Requests the validation of a policy and returns a list of findings. The findings help you identify issues and provide actionable recommendations to resolve the issue and enable you to author functional policies that meet security best practices.

Parameter Syntax

$result = $client->validatePolicy([
    'locale' => 'DE|EN|ES|FR|IT|JA|KO|PT_BR|ZH_CN|ZH_TW',
    'maxResults' => <integer>,
    'nextToken' => '<string>',
    'policyDocument' => '<string>', // REQUIRED
    'policyType' => 'IDENTITY_POLICY|RESOURCE_POLICY|SERVICE_CONTROL_POLICY|RESOURCE_CONTROL_POLICY', // REQUIRED
    'validatePolicyResourceType' => 'AWS::S3::Bucket|AWS::S3::AccessPoint|AWS::S3::MultiRegionAccessPoint|AWS::S3ObjectLambda::AccessPoint|AWS::IAM::AssumeRolePolicyDocument|AWS::DynamoDB::Table',
]);

Parameter Details

Result Syntax

[
    'findings' => [
        [
            'findingDetails' => '<string>',
            'findingType' => 'ERROR|SECURITY_WARNING|SUGGESTION|WARNING',
            'issueCode' => '<string>',
            'learnMoreLink' => '<string>',
            'locations' => [
                [
                    'path' => [
                        [
                            'index' => <integer>,
                            'key' => '<string>',
                            'substring' => [
                                'length' => <integer>,
                                'start' => <integer>,
                            ],
                            'value' => '<string>',
                        ],
                        // ...
                    ],
                    'span' => [
                        'end' => [
                            'column' => <integer>,
                            'line' => <integer>,
                            'offset' => <integer>,
                        ],
                        'start' => [
                            'column' => <integer>,
                            'line' => <integer>,
                            'offset' => <integer>,
                        ],
                    ],
                ],
                // ...
            ],
        ],
        // ...
    ],
    'nextToken' => '<string>',
]

Result Details

Errors

InternalServerException:

Internal server error.

ValidationException:

Validation exception error.

ThrottlingException:

Throttling limit exceeded error.

AccessDeniedException:

You do not have sufficient access to perform this action.